A critical PHP security update just landed. Your website needs it

The PHP project shipped emergency fixes on October 21 for two critical flaws that can let an attacker run code on a web server without logging in. PHP runs most of the web, including every WordPress site, so this PHP security update is one to confirm with your host today, not next month. Here's what happened, how to check your site in two minutes and what to ask your hosting company.

What the PHP security update fixes

The PHP security team's advisory covers two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "php2shell." Each is rated 9.2 out of 10 on the CVSS v4 severity scale. Both can allow remote code execution by an attacker who doesn't need a username or password.

In plain terms, one flaw involves how PHP cleans up when a request runs out of memory partway through. The other involves leftover data from one visitor's request that a later request on the same server process can misuse. You don't need the technical details. You need to know the fix is a new version of PHP itself:

• PHP 8.5 users need 8.5.12
• PHP 8.4 users need 8.4.27
• PHP 8.3 users need 8.3.36
• PHP 8.2 users need 8.2.35 (8.2 reaches end of life on December 31, 2026)

The PHP team says the highest risk is on servers using Apache's mod_php, where a single unauthenticated request can trigger the attack before any website code runs. Other common setups are also affected. Linux distributions and long-term support vendors received the patches in advance, so updated packages may already be available from your vendor.

Why this one is bigger than a routine patch

Three things make this release stand out.

PHP is everywhere. According to W3Techs, PHP powers 69.3% of websites whose server-side language is known. WordPress, WooCommerce, Joomla, Drupal and countless custom sites run on it.

Old versions get no official fix. PHP 8.1 and older no longer receive updates from the PHP project. W3Techs data shows 27.0% of PHP sites still run PHP 7 and 7.7% run PHP 5. The PHP team notes that minimal source backports exist for 7.4, 8.0 and 8.1, and some Linux vendors may ship their own fixes, but you can't assume your host has applied them.

The risk is real, even if attacks are early. The US Cybersecurity and Infrastructure Security Agency (CISA) published an alert on October 21 urging organizations to patch immediately, starting with internet-facing systems. CISA said it had not observed exploitation as of publication. Tenable reported the same day that Cloudflare's CTO said the company was seeing early attacks, and that code claiming to exploit the flaws is circulating publicly, though Tenable hadn't verified it.

Your website is only as secure as the server it runs on.

Check your PHP version in two minutes

You don't need server access to find out where you stand.

1. On WordPress: go to Tools, then Site Health, then the Info tab, and open the Server section. Your PHP version is listed there. The WordPress security team points site owners to the same screen.
2. On other platforms: your hosting control panel usually shows the PHP version for each site.
3. Compare it to the list above. If you're on 8.2 through 8.5 but below the fixed number, you need the update. If you're on 8.1 or older, you have a bigger problem: plan an upgrade to a supported version, not just a patch.

WordPress says no WordPress update is needed or planned for this issue, because the flaws are in PHP itself, not in WordPress code.

Who has to act: you or your host?

That depends on how your site is hosted.

Shared or managed hosting. Your host controls PHP, so the update is theirs to install. The WordPress post notes that many hosts may already be patching or adding firewall rules, but it still tells site owners to confirm. Send your host a short message today asking which PHP version your site runs, whether it includes the October 21 fixes and whether PHP processes were restarted afterward.

Your own server or VPS. Install the patched packages from PHP, your Linux distribution or your control panel vendor, then restart PHP-FPM or your web server so the new code actually loads. Take a backup first and test your site afterward.

If you can't update right away. The PHP advisory lists partial workarounds, such as turning off session upload progress and tightening upload size limits, but says updating is the only complete fix. CISA goes further: if a PHP system can't be updated, or still runs PHP 8.1 or earlier, take it offline until it's patched or upgraded. Tenable notes Cloudflare has added firewall rules for known attack patterns, including for free-plan customers, but Cloudflare itself calls that a stopgap.

OnlyaClick tip: Ask your host for the exact PHP version, not a yes-or-no "we're patched." If they use a Linux vendor's backported package, the version number may look older than 8.2.35, so ask them to confirm in writing that it includes fixes for CVE-2026-109618 and CVE-2026-109619. Save the reply with your website records.

If you don't know who hosts your site, or the person who built it has moved on, now is a good time to find out. A website team that maintains your site should be able to answer these questions within the day.

While you're in there: WordPress 7.1.3

This PHP security update arrives about two weeks after a separate WordPress fix. On October 6, WordPress released version 7.1.3, a maintenance and security release with seven security fixes and four bug fixes. The security issues included a stored cross-site scripting flaw on the Comments admin screen and a SQL injection issue in the export tool. The security team recommended updating immediately.

Sites with automatic background updates should already be on 7.1.3. To be sure, open Dashboard, then Updates. While you're there:

• Update plugins and themes, and delete the ones you no longer use.
• Make sure you have a recent, working backup stored off the server.
• Check that only current staff have administrator accounts.

Good website security also protects your search visibility. A hacked site can pick up spam pages, redirects or malware warnings, and cleaning that up takes far longer than patching. If your rankings or traffic have looked odd lately, a technical SEO audit can rule out security problems hiding in plain sight.

The bottom line

The October 21 PHP security update fixes two critical flaws that could let attackers take over a web server without logging in, and it affects nearly every PHP website. Check your PHP version in Site Health or your control panel today, confirm with your web hosting company that the fixed release is installed and running, and plan an upgrade if you're on PHP 8.1 or older. Then make sure WordPress itself is on 7.1.3. Thirty minutes of checking now is far cheaper than cleaning up a hacked site later.